[AH7]

Snyk has created this PR to fix 2 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Uncontrolled Recursion SNYK-JS-BRACES-19963945	721
	Infinite loop SNYK-JS-URIJS-19963963	721

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Uncontrolled Recursion

[AH7]

This upgrade includes multiple major version jumps with significant breaking changes. The two most impactful are jsonld and rdflib, both of which have modernized their APIs, requiring developer action. The solid-permissions package is deprecated and should be replaced.

Top 3 Impactful Upgrades

1. jsonld: 0.4.12 → 5.0.0 (HIGH RISK)

This is a very large version jump across multiple major releases, introducing several critical breaking changes. Code modifications are required.

• Asynchronous API Change: Support for callbacks has been removed in favor of Promises and async/await since v2.0.0. This is a fundamental change to how asynchronous operations are handled and will require refactoring.
• Node.js Version Support: Version 5.0.0 drops support for Node.js versions below 12.
• Dependencies & Behavior: The internal document loader was switched from request to @digitalbazaar/http-client, and the default processing mode is now json-ld-1.1. The underlying rdf-canonize dependency also has breaking changes that may alter the output of jsonld.normalize().

Source: GitHub Changelog

Recommendation: Plan for significant refactoring to adopt the Promise-based API. Ensure your Node.js version is 12 or higher. Review code that relies on document loading or canonicalization for behavioral changes.

2. rdflib: 0.12.3 → 2.2.1 (HIGH RISK)

This is a massive version upgrade for this RDF library. While a complete changelog for this entire range is not available, the age of the starting version and common JavaScript modernization patterns indicate a high likelihood of breaking changes.

• Likely Asynchronous API Change: Older versions of similar libraries relied on callbacks for asynchronous operations like parsing and serializing. It is highly probable that the library has since migrated to a modern Promise-based API, which would be a major breaking change.
• Large Version Gap: The jump from v0.12.x to v2.2.x spans many years of development. It is unsafe to assume any level of API compatibility.

Source: Package documentation

Recommendation: Treat this as a migration to a new library. Carefully review the current rdflib.js documentation and refactor your implementation to match the modern API, paying close attention to asynchronous methods.

3. solid-permissions: 0.4.2 → 0.5.1 (HIGH RISK)

This package was archived in 2019 and is deprecated. The README explicitly recommends migrating to acl-check.js.

Source: GitHub Repository

Recommendation: Migrate from

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.